Vendor Due Diligence Software After the Questionnaire

The questionnaire gets the vendor through the gate. It does not keep the file current. If you are evaluating vendor due diligence software, ask what it does with the live documents after the security pack is filed: the subprocessor list, the data processing agreement and the AI-usage terms.

Due diligence, in most SaaS buying motions, still means a burst of work at onboarding. SOC 2, policies, SIG or CAIQ answers, maybe a privacy addendum. Then the folder goes quiet until renewal. The documents that actually change mid-contract are usually elsewhere on the vendor’s site. Software that only improves the burst leaves the quiet months unwatched.

For the buyer’s continuous-watch scorecard, see third party risk management software. For laying contractual clocks against an annual calendar, see vendor risk management software. This post stays on the three documents that should remain alive after the questionnaire is filed.

What the questionnaire already covered (and what it did not)

A solid onboarding pack answers whether encryption exists, whether access reviews run, whether a SOC 2 Type II is in date, and how the vendor talks about incidents in the abstract. Our note on SOC 2 Type I versus Type II covers what the report itself can prove.

What the same pack rarely pins down with lasting precision:

• Who else may process the personal data tomorrow (the subprocessor list).
• The contractual clocks for notice, objection, breach notification and deletion (the DPA).
• Whether customer content can reach a model provider, and on what terms (AI addenda and list rows).

Those three artefacts are the post-questionnaire set. Vendor due diligence software worth buying either reads them on a schedule or makes it trivial for your team to. Privacy counsel and security reviewers often split ownership here by accident. Security owns the questionnaire library; privacy owns the DPA; nobody owns the list URL after the kick-off call. The buying criterion is whether one system (or one clear process) keeps all three in the same vendor file with dates.

What to capture per document at onboarding

Before the folder goes quiet, file a dated capture for each artefact. A workable field list:

Subprocessor list

• Authoritative list URL and the date you saved it.
• Products on your order form that the list scopes to.
• For each high-sensitivity row: legal name, purpose, location, and whether data categories are stated.
• Notice subscription channel (email, portal) if the DPA points to one.

Data processing agreement

• DPA URL or executed PDF version identifier, and the date.
• Subprocessor notice period and channel; objection window and trigger.
• Breach notification period, trigger (security incident versus personal data breach) and any “where feasible” qualifier.
• Audit right model and frequency; transfer mechanisms named; deletion or return on termination.

AI-usage terms and AI list rows

• AI addendum or product-terms URL, if any.
• Model providers named on the list, with purpose and location as published.
• Any feature-flag or product-edition language that gates the AI path.
• Training, retention and opt-out positions only where the vendor’s document states them; leave them blank when not stated.

Those fields are what “done” should mean at boarding. Everything after that is watching whether they move.

Document 1: the subprocessor list

After signature, the list is the operable face of general authorisation under Article 28(2) of the GDPR. You need name, purpose and location on each row you care about. Category labels, “various” locations and blank purposes are gaps, not neutral silence. For the legal idea behind the list, see what a subprocessor is.

Dated examples help set the standard. As of our check on 25 September 2026, Atlassian’s list names Amazon Web Services, Inc. for cloud hosting and support across multiple regions, Clumio, Inc. for S3 backup (EEA, UK, Australia, USA, Singapore), and Databricks, Inc. for querying and analytics features in the USA, with customer personal data categories stated on those rows. The same list also carries generative AI providers elsewhere in the extract. A questionnaire that asked “do you use subprocessors?” last spring does not substitute for reading those rows today.

When you browse the ClauseTrail directory of published subprocessor lists, you are looking at this post-questionnaire artefact across vendors, not at another attestation form.

Document 2: the data processing agreement

The DPA is where the questionnaire’s “yes, we notify” answers become numbers and channels. As of our check on 25 September 2026, Stripe’s DPA commits to email at least 30 days before adding a subprocessor takes effect, to notify Data Incidents affecting personal data subject to the GDPR or UK GDPR no later than 48 hours, and to rely on the 2021 standard contractual clauses and Data Privacy Framework self-certification for transfers. Those fields are what you file beside the signed order form.

Post-questionnaire diligence means two jobs on the DPA: extract the fields once at boarding, then watch for revisions. A quiet edit to transfer language or retention can land between SOC 2 periods without touching the questionnaire library. For how SCCs and the Data Privacy Framework differ when a destination sits outside the EEA, see standard contractual clauses versus the Data Privacy Framework.

Document 3: AI-usage terms (and AI rows on the list)

AI diligence splits across two pages. The subprocessor list may name a model provider with a purpose line. Separately, an AI addendum or product terms may state training, retention, opt-outs and which features send content.

As of our pull tied to list extractions on 25 September 2026, Zoom’s list names OpenAI as an intelligent features service provider in the United States and the European Union, with wording that OpenAI may process customer content and context if AI features are enabled. That conditional list row is already post-questionnaire material: it tells you which product settings matter. We have not published a reading of Zoom’s AI-usage terms yet, so this post does not state its training or opt-out positions. Open the vendor’s own AI schedule for that layer rather than inventing an answer.

Vendor due diligence software that ignores AI rows because “AI was not in last year’s SIG” will miss the fastest-moving part of many SaaS stacks.

How to buy vendor due diligence software for the after-file

Keep the questionnaire workflow if it works for your security team. Buy or configure the product so the after-file is first-class:

1. Capture at onboarding: list URL, DPA URL, AI terms URL, plus the extracted fields in the list above.
2. Watch: scheduled reads of those URLs with structured diffs, not only a calendar reminder to “re-diligence”.
3. Decide: each material change gets an owner and a recorded outcome before the notice window closes.
4. Store: decisions sit next to the versions they were made against, so renewal is a refresh of a known file.

Category tools (due-diligence portals, VRM suites, GRC platforms and dedicated document monitors) mix these jobs differently. In demos, ask to see a mid-contract list change and a DPA wording change, not only a questionnaire dashboard. Plan details belong on the vendor’s pricing page; the RFP should ask whether document history and AI-term watch sit in the core path.

A quick RFP probe: ask the vendor to show the last change they would have surfaced for a reference customer on each of the three documents. If the demo only replays questionnaire scoring, you are still looking at the gate, not the after-file.

ClauseTrail’s how continuous document monitoring works page describes the watch loop for the three artefacts above.

The one check worth making this week

Take three vendors you boarded in the last year. Open the questionnaire folder, then open today’s subprocessor list, DPA and any AI schedule. Write down one fact from each live document that is not in the questionnaire answers. If you cannot finish that without hunting trust centre tabs, your vendor due diligence software (or process) stops at the gate.

ClauseTrail monitors vendor subprocessor lists, DPAs, privacy policies, terms of service and AI-usage terms after onboarding, and alerts compliance teams when they change. See the directory of subprocessor lists and pricing.

Frequently Asked Questions

What should vendor due diligence software watch after the questionnaire?

At minimum the live subprocessor list, the data processing agreement and any AI-usage terms or AI rows on the list. Questionnaires and SOC 2 reports remain useful at boarding and renewal. They do not replace reading those three artefacts between cycles.

Why is the subprocessor list part of due diligence if we already signed a DPA?

The DPA usually grants general authorisation under Article 28(2) and sets notice rules. The list is where named entities, purposes and locations appear. Diligence that files the DPA but never reopens the list misses the operational half of that authorisation.

Do we need separate AI terms if OpenAI (or another model provider) is already on the list?

Yes, when they exist. The list row shows engagement and often purpose and location. AI terms typically address training, retention, opt-outs and feature-level controls. We have not published readings of every vendor’s AI terms yet; do not invent the missing layer from the list row alone.

Is this the same as buying continuous monitoring?

Continuous monitoring is how you keep the post-questionnaire set current. Due diligence software may or may not include that watch. When you buy, require both the onboarding workflow and the live-document job, or accept that you are only automating the gate.

How does this differ from TPRM or VRM software?

Third-party risk and vendor risk posts cover the buyer’s continuous-watch scorecard and the annual-versus-clock calendar. Vendor due diligence software, in this framing, is the narrower after-file question: once onboarding is done, which three documents stay alive, and does your tooling keep them dated.